The explicit KBA prohibition found in SP 800-63B-4 is scoped to password selection, so the document does not by that sentence alone ban a contact center from asking knowledge questions; it simply gives KBA no standing as an authenticator.
inferred · Checked 2026-09-30
- Vendor
- NIST
- Product
- SP 800-63B-4
- Subsystem
- passwords
- Deployment
- any
- Region
- us
- Release range
- revision 4
- Status
- inferred
- Checked
- 2026-09-30
Sources
- NIST SP 800-63B-4 Digital Identity Guidelines: Authentication and Authenticator Management — National Institute of Standards and Technology · tier 1 standards and regulators · Sec. 3.1.1.2 read against the authenticator types listed in Sec. 3.1
Cite this note
APA
WarmTransfer. (2026, September 30). Caller authentication and fraud prevention in contact centers: source note contact-center-caller-authentication-nist-kba-scope. WarmTransfer. https://warmtransfer.net/knowledge/claims/contact-center-caller-authentication-nist-kba-scope
BibTeX
@misc{warmtransfer-claim-contact-center-caller-authentication-nist-kba-scope,
title = {Caller authentication and fraud prevention in contact centers: source note contact-center-caller-authentication-nist-kba-scope},
author = {{WarmTransfer}},
year = {2026},
url = {https://warmtransfer.net/knowledge/claims/contact-center-caller-authentication-nist-kba-scope},
note = {Source note contact-center-caller-authentication-nist-kba-scope, checked 2026-09-30}
}